From cbb4c260c40779ba84c794dd68147c54f3de2f52 Mon Sep 17 00:00:00 2001
From: Ivan Kohler <ivan@freeside.biz>
Date: Fri, 1 Jun 2012 17:15:27 -0700
Subject: RT 3.8.13

---
 rt/share/html/Elements/EditCustomField | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'rt/share/html/Elements/EditCustomField')

diff --git a/rt/share/html/Elements/EditCustomField b/rt/share/html/Elements/EditCustomField
index 6c5d7f5cf..32ea59deb 100644
--- a/rt/share/html/Elements/EditCustomField
+++ b/rt/share/html/Elements/EditCustomField
@@ -85,7 +85,7 @@ if ($MaxValues == 1 && $Values) {
 }
 # The "Magic" hidden input causes RT to know that we were trying to edit the field, even if 
 # we don't see a value later, since browsers aren't compelled to submit empty form fields
-$m->out("\n".'<input type="hidden" class="hidden" name="'.$NamePrefix.$CustomField->Id.'-Values-Magic" value="1" />'."\n");
+$m->out("\n".'<input type="hidden" class="hidden" name="'.$m->interp->apply_escapes($NamePrefix, 'h').$CustomField->Id.'-Values-Magic" value="1" />'."\n");
 
 my $EditComponent = "EditCustomField$Type";
 $m->callback( %ARGS, CallbackName => 'EditComponentName', Name => \$EditComponent, CustomField => $CustomField, Object => $Object );
-- 
cgit v1.2.1